1) I am using below code to getting all machines list ,   | metadata type=host index=* | stats count by host     is possible to get IP address also ?  2)  Here also I need IP address required, index=windeventlog sourcetype=winEventLog:Security EventCode=4625 | stats count by Account_Name, EventCode, Workstation_Name | cort by - count   please suggest.    Thanks in advance.  ... View more

Below is my code and I want to display only "Druv" Failed logins. But, I see the user name 'None' , 'Karla' and other few names. How avoid the unwanted users in the output index=wineventlog source="WinEventLog:Security" sourcetype=WinEventLog:Security EventCode=4625 where Account_Name=Druv | stats count by _time, Workstation_Name,Account_Name,dest, dest_nt_domain, product, app, action, EventCode, EventCodeDescription, Failure_Reason, name | sort _time | where Account_Name!="-" Thanks in advance ... View more

I want to search "August 2018 activity on machine DNS-DC-01" Could you please help me, how to use metadata for particular host ? I do not have any idea. thanks in advance ... View more

Hello, I am receiving the false user account lockout report on particular user account. I am getting one user account lockout report daily with count of 25 to 40. But the user is active state, he is able to login and doing his daily tasks.and I cross checked with system administrator team, is the user active or locked. They told the user us active. From July 3rd I am receiving, user account same, host same, only I don’t know why splunk triggering that particular user account lockouts. Here the code which I am using for daily report. Sourcetype=WinEventLog.Security Event=4740 | stats count by Accout_Name |sort – count | rename count as “Accout Lockouts” If I search particular user account below event codes are also showing, user=”Kiran” A user account was locked out - 4740 A new process had been created - 4688 The state of a transaction has changed – 4985 Source WinEventLog.Security Sourcetype WinEventLog.Security Host SYS-MACHINE1, SYS-MACHINE2, SYS-MACHINE3 Action modified & success Msad_action 35 May I know is the problem with splunk or anything else ? ... View more

May I know what is User Activity as per PCI requirement 10 ? On going SSAE 18 audit, there is one question - please provide the Daily Group and User activity report evidence of their review and evidence of investigation and follow-up (if applicable). Please share me if anyone have an idea regarding this! Thanks in advance. PCI Requirement 10: Track and monitor all access to network resources and cardholder data Logging mechanisms and the ability to track user activities are critical in preventing, detecting and minimizing the impact of a data compromise. The presence of logs in all environments allows thorough tracking, alerting and analysis when something does go wrong. Determining the cause of a compromise is very difficult, if not impossible, without system activity logs. ... View more

Anyone help me on below, 1) Login 2) Logoff 3) Un-successful login 4) Modify authentication mechanisms 5) Create user account 6) Modify user account 7) Create role 8) Modify role 9) Grant/revoke user privileges 10) Grant/revoke role privileges 11) Privileged commands 12) Modify audit and logging 13) Objects Create/Modify/Delete 14) Modify configuration settings I checked and confirmed, Splunk TA is installed in all windows machines and Splunk TA is installed for Active directory server. Thanks in advance. ... View more

Anyone help me on below, 1) Login 2) Logoff 3) Un-successful login 4) Modify authentication mechanisms 5) Create user account 6) Modify user account 7) Create role 8) Modify role 9) Grant/revoke user privileges 10) Grant/revoke role privileges 11) Privileged commands 12) Modify audit and logging 13) Objects Create/Modify/Delete 14) Modify configuration settings Thanks in advance. ... View more